Anyone getting FiveStars text message spam?

[SteveRiley]

Yesterday I was in the car, on my way to symphonic band rehearsal. My phone buzzed with a text message. Not all that unusual of an occurrence. But a very unusual message:

From: 578277
Message: "We added Stacia's Pizza to your FiveStars account! You're 10 pts from a $15 off next purchase. Register at FiveStars for 5 free points! (txt OFF to unsubscribe)"

There are two creepy aspects to this. One, I've never heard of FiveStars, and thus have no account. Two, the message arrived just as we drove past -- indeed -- a Stacia's Pizza.

Some Googling doesn't reveal much. Yes, they exist (www.fivestarscard.com) and they got some press about funding in August. Curiously, I'm unable to find any other reports of people receiving unsolicited FiveStars text messages as they drove past merchants.

I'm rather annoyed by all this. Some app on my Android phone must be leaking location information and my phone number without my knowledge. If this is a harbinger of the future, then I will become one very cranky person.

[dmeyer]

If you run CM7.x on your phone then you can revoke permissions for Apps. It can cause some to malfunctions but most apps catch errors just fine. There are a few apps on the market but none are really all that good. There is this: http://whispersys.com/permissions.html which looks promising but I can't find its download.

[HalationEffect]

Could be simply a coincidence that you got the message while driving past the pizza joint... stranger coincidences have happened.

Example: many years ago in the UK, back when public phone boxes were much more common than they are now, a member of the AA (similar to AAA in the US, and nothing to do with alcoholism) was walking past a public phone box when it began to ring. For the purpose of this story, we'll call him "Alan Jackson", as it's years since I read about this and I can't recall his actual name. He decided to answer the phone, and was stunned to hear the person on the line ask him to confirm that he was Mister Alan Jackson. Turns out it was the AA calling to remind him that he needed to renew his membership fairly soon, but had mistakenly dialled his membership number instead of his phone number, and by the most bizarre of coincidences that number turned out to be the number of the phone box that he happened to be walking past at that exact moment...

[kubicle]

Turns out it was the AA calling to remind him that he needed to renew his membership fairly soon, but had mistakenly dialled his membership number instead of his phone number, and by the most bizarre of coincidences that number turned out to be the number of the phone box that he happened to be walking past at that exact moment...

It's only bizarre it they weren't using an 'Infinite Improbability Drive'

(http://hitchhikers.wikia.com/wiki/In...bability_Drive)

[HalationEffect]

It's only bizarre it they weren't using an 'Infinite Improbability Drive'

(http://hitchhikers.wikia.com/wiki/In...bability_Drive)

Who wants to use that old, busted tech any more? It's all bistromathics nowadays

(Edit) Now cue Steve getting his mind blown that this topic randomly went to Hitch-Hiker's Guide references so fast!

[dmeyer]

All jokes aside. Android Apps do have serious permission problems. The most arbitrary app asks for permissions it really shouldn't need like access to contacts or network access etc etc. The biggest problem is that stock android has no way of handling this and your only choice is accept the permissions or live without the app.

The other day we had a nice thread explaining how UAC in Vista was designed to change developer ways. Maybe Android needs to go that route too!

[HalationEffect]

stock android has no way of handling this and your only choice is accept the permissions or live without the app

This is the part I find quite shocking. So, it's an all-or-nothing deal with Android app permissions? No granularity at all?

So far, my reason for not having a smartphone has been that I didn't have anywhere like a strong enough need for one to justify the expense... but now I'm sort of glad that I don't have one. If you consider costs as being not just financial, but also (potential) loss of privacy, then both costs are simply too high for me.

[dmeyer]

This is the part I find quite shocking. So, it's an all-or-nothing deal with Android app permissions? No granularity at all?

Not with stock android and not with newer CM releases. When it comes to OEM spins expect the experience to much more limited. The only real, working solution is something known as Pdroid which is open source and quite brilliant to be honest. The catch? Pdroid is really difficult to install, even for competent Linux users and hasn't been updated for android 4.x. There is a port to ICS and Jellybean but because Google keeps making fairly sweeping changes to its frameworks means that its really not always working.

Fortunately I'm not an app crazy person. I just want basic apps, a couple of games and control of my platform. Fortunately CM with Tasker and the standard apps meets 90% of my needs. I also won't install apps with ridiculous permissions and fortunately many devs are now explaining why they need certain permissions which gives me confidence. Transparency is really important to me. They might be lying but their gesture of good faith gives me a lot of confidence.

[tek_heretik]

I have all that locating stuff shut off in my 'droid, sucks battery and bandwidth, and I LIKE my privacy. Google has become the new Big Brother, creepy. I believe you Steve, and can easily see that happening, when I first got my 'droid, I fiddled with it and noticed the same type of activity, I found it quite alarming, hence all the disabling. Before I download an app, I look at it's permissions, if the list is longer than my arm, no download, no install.

Edit: I switched to SRWare Iron browser and stopped using Google search, personally, I've had enough of Google.

[HalationEffect]

I guess I'll be continuing to eschew smartphones for the foreseeable future then.

Furthermore if I ever decide to buy a tablet, it won't run android, and it most definitely won't run iOS (shudder). I'll only consider a tablet that runs Plasma Active or something equally open and transparent, preferably produced by an open-source community effort or some non-profit organisation.

There's just too much greed and sleaziness in this world. Can somebody please stop the planet? I want to get off.

[tek_heretik]

There's just too much greed and sleaziness in this world. Can somebody please stop the planet? I want to get off.

I hear that, makes me very wary about everything I do. We have no-call phone spam (as I call it) rules here in Canada, what they are doing now is phoning from U.S. phone numbers to circumvent those rules, there is just no end to the sleaziness.

[dmeyer]

I have all that locating stuff shut off in my 'droid, sucks battery and bandwidth, and I LIKE my privacy.

Everybody switches off the constant location gathering. Its possible to deny other apps but give Google apps special permissions which I do. I quite like Google Now and all its functionality. I know its pries into my privacy but I don't have any really confidential information on any Google servers.

If you have Tasker you can set it to automatically enable say GPS when Maps is opened. Tasker is the ultimate geek app for Android. Its actually my favorite thing about Android.

I'll only consider a tablet that runs Plasma Active or something equally open and transparent, preferably produced by an open-source community effort or some non-profit organisation.

Not happening anytime soon although I really wish it would. Have you seen how gorgeous Kontact Active is?

[SteveRiley]

If you run CM7.x on your phone then you can revoke permissions for Apps. It can cause some to malfunctions but most apps catch errors just fine.

When I was using a CM 7 derivative (ILWT) on my G2, I tried mucking around with this, but too many things broke.

There are a few apps on the market but none are really all that good.

LBE Privacy Guard actually worked very well: rather than revoking permissions, it simply spoofs responses. If I instructed LBE PG to disallow StupidApp from reading my call logs, then when StupidApp tries to do that, LBE PG replies with bogus info. Alas, the tool hasn't been updated for ICS and JB. LBE PG causes newer Androids to enter into bootloops. Workarounds exist to make the bootloop go away, but I think the permissions spoofing function fails to do its thing under ISC and JB.

(Edit) Now cue Steve getting his mind blown that this topic randomly went to Hitch-Hiker's Guide references so fast!

LOL. Always make me smile

I have all that locating stuff shut off in my 'droid

Normally I do, too. I just forgot to switch it off!

If you have Tasker you can set it to automatically enable say GPS when Maps is opened. Tasker is the ultimate geek app for Android. Its actually my favorite thing about Android.

Sounds like something to investigate, thanks for the tip.

[Guest]

Victor from FiveStars here. I'm actually the founder of the company you're referring to (I saw this on the xda forums as well). Everyone who's saying this is a coincidence is right -- we actually have no idea where you are.

We provide loyalty cards for small businesses, so for example Stacia's Pizza uses us to manage their Buy 10 Get 1 free program so you don't have to carry around a bunch of paper punch cards. They must have enrolled you when you ordered a pizza from them at some point, but the usual text message was delayed (you're supposed to get it right away, so these creepy scenarios don't happen).

Hope that helps! Our goal is to get you more free stuff without having to carry around all of that paper anymore.

Vic

[SteveRiley]

Yes, Victor, I posted the message on XDA, and also posted it here, where I am one of the administrators. For the benefit of our members, I'll include the same reply here.

---

While I may be willing to accept that FiveStars has no knowlege of my presence, I'm unwilling to accept -- for the moment -- that my experience was purely a coincidence. I am not a customer of the pizza shop in question, so I'm unsure how they would have obtained my phone number. Furthermore, as a rule I don't join loyalty programs because the value they provide is not worth the information I must trade.

I will admit that I recently flashed a new build of JB on my G2, and when I was passing the pizza shop, I had not yet gone through my usual procedures of removing or otherwise blocking the various anti-privacy mechanisms that plague Android. See my post from a few months ago for some examples.